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Presented to the Court by the foreman of the 
Grand Jury in open Court, in the presence of 
the Grand Jury and FILED in the U.S. 
DISTRICT COURT at Seattle, Washington. 



Judge Robert S. Lasnik 


UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF WASHINGTON 
AT SEATTLE 


UNITED STATES OF AMERICA, 
Plaintiff, 


V. 

MUHAMMAD FAHD and 
GHULAM JIWANI, 


NO. CR17-0290RSL 

SECOND SUPERSEDING 
INDICTMENT 


Defendants. 


The Grand Jury charges that: 

INTRODUCTION 


At all times material to this Second Superseding Indictment: 

1. AT&T Mobility LLC (hereinafter, AT&T), was a company with 
headquarters in Atlanta, Georgia, and offices throughout the United States, including a 
customer service call center in Bothell, Washington. 

2. AT&T sold cellular telephones and offered monthly voice and data plans 
for use with the phones on the AT&T wireless network. AT&T phones and wireless 
services were sold through authorized AT&T dealers and retailers across the country. 

3. New cellular phones, such as iPhones, cost hundreds of dollars, with many 
top-end models costing over $500. To make phones more affordable, AT&T either 
subsidized the purchase cost of phones or provided an option to purchase phones under 
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an interest-free installment plan. To be eligible for either option, customers needed to 
agree to enter into long-term service contracts that bound them to AT&T’s wireless 
network. 

4. AT&T used proprietary locking software on AT&T phones that prevented 
the phones from being used on any wireless network other than the AT&T network 
unless and until the phones were “unlocked.” 

5. “Unlocking” a phone disabled the proprietary locking software and thereby 
allowed the phone to be used on multiple carrier systems rather than exclusively with 
AT&T. 

6. The Wireless Customer Agreement between AT&T and each of its 
customers provided that AT&T would unlock the customer’s phone upon the satisfaction 
of certain criteria, such as when the customer had satisfied the terms of his or her service 
contract and/or installment plan. 

7. Unlocked phones were a valuable commodity because they could be resold 
and used on any other compatible network around the world. If an AT&T customer’s 
phone was unlocked with or without authorization, that customer could switch to another 
carrier. If this happened, AT&T would be deprived of the remaining value of the 
customer’s service contract and, if applicable, remaining payments imder the customer’s 
installment plan. 

8. When phones were unlocked fraudulently without AT&T’s authorization 
and customers switched service to other carriers, the fraudulent transactions deprived 
AT&T of the stream of payments that were due under the service contracts and 
installment plans. 

9. AT&T employees at AT&T’s Mobility Customer Care call center in 
Bothell, Washington, had access to AT&T’s computer systems to assist AT&T customers 
with service and billing issues. Among other things, AT&T employees at the call center 
had the ability to submit unlock requests on behalf of eligible customers. 
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10. AT«feT employees used a variety of internal computer programs at AT&T 
to process unlock requests. Access to the systems was limited to authenticated users 
connected to AT&T’s internal and protected corporate network. 

11. AT&T’s unlocking systems permitted AT&T employees with proper 
authorization and network credentials to, in appropriate circumstances, send requests to 
unlock the phones of AT&T customers. 

12. Malware was malicious computer code running on a computer that was not 
authorized by the owner/authorized user of that computer. Malware could be designed to 
do a variety of things, including logging every keystroke on a computer, stealing 
information or “user credentials” (passwords or usernames), and executing unauthorized 
commands without the consent of the authorized user. 

COUNT 1 

(Conspiracy to Commit Wire Fraud) 

13. The allegations contained in Paragraphs 1 through 12 of this Second 
Superseding Indictment are re-alleged and incorporated as if fully set forth herein. 

I. THE OFFENSE 

14. Begiiming at a date unknown, but no later than April 2012, and continuing 
through in or about September 2017, at Bothell, within the Western District of 
Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM 
JIWANI, and others known and unknown to the Grand Jury, did knowingly and 
intentionally, agree and conspire to devise and execute and attempt to execute, a scheme 
and artifice to defraud, and for obtaining money and property by means of materially 
false and fraudulent pretenses, representations, and promises; and in executing and 
attempting to execute this scheme and artifice, to knowingly cause to be transmitted in 
interstate and foreign commerce, by means of wire communication, certain signs, signals 
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and sounds as further described below, in violation of Title 18, United States Code, 
Section 1343. 

II. THE OBJECT OF THE CONSPIRACY 

15. The object of the conspiracy was to gain access to AT&T’s protected 
internal computers without authorization, and in excess of authorization, by bribing 
AT&T employees to submit fraudulent and unauthorized cellphone unlocking requests 
through AT&T’s internal protected computer network through, among other means, the 
installation of malware and unauthorized hardware on AT&T’s internal network. The 
object further was to sell to members of the public the resulting ability fraudulently to 
unlock phones, so that the members of the public could stop using AT&T wireless 
services and thereby deprive AT&T of the stream of payments it was owed under the 
customers’ service contracts and installment plans. 

III. MANNER AND MEANS OF THE CONSPIRACY 

A. Overview of the Conspiracy 

16. It was part of the conspiracy that MUHAMMAD FAHD, GHULAM 
JIWANI and others known and unknown to the Grand Jury, gained unauthorized access 
to AT&T’s internal protected computers through a variety of methods, including by 
bribing AT&T employees (hereinafter “insiders”) at AT&T’s call center in Bothell, 
Washington, to use their network credentials and exceed their authorized access to 
AT&T’s computers to submit large numbers of fraudulent and unauthorized unlock 
requests on behalf of the conspiracy and to install malware and unauthorized hardware on 
AT&T’s systems. 

17. From in or about April 2012 to in or about April 2013, MUHAMMAD 
FAHD, and others known and unknown to the Grand Jury, transmitted instructions to the 
insiders via the wires in interstate and foreign commerce, including lists of cellular 
telephone international mobile equipment identity (IMEI) numbers for the insiders to 
submit for fraudulent and unauthorized unlocking. 
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18. From in or about April 2013 to in or about October 2013, MUHAMMAD 
FAHD, GHULAM JIWANI and others known and unknown to the Grand Jury, bribed 
insiders to plant malware on AT&T’s internal protected computers for the purpose of 
gathering confidential and proprietary information on how AT&T’s computer network 
and software applications functioned. 

19. Using information gathered by this malware about AT&T’s eomputer 
network and software applications, MUHAMMAD FAHD, and others known and 
unknown to the Grand Jury, created additional malware designed to internet with 
AT&T’s internal protected computers and process fraudulent and unauthorized unlock 
requests submitted over the wires in interstate commerce from remote servers eontrolled 
by members of the conspiracy. 

20. The malware MUHAMMAD FAHD, and others known and unknown to 
the Grand Jury, planted on AT&T’s internal protected computers used network 
credentials that belonged to actual AT&T employees, ineluding co-conspirators and 
others, to allow MUHAMMAD FAHD, and others known and unknown to the Grand 
Jury, to log into AT&T’s internal protected computers under false pretenses and to 
proeess fraudulent and unauthorized unlock requests. 

21. From in or about November 2014 to in or about September 2017, 
MUHAMMAD FAHD, GHULAM JIWANI and others known and unknown to the 
Grand Jury, bribed insiders to use their access to AT&T’s physical work space to install 
unauthorized computer hardware deviees, including wireless aceess points designed to 
provide the conspiracy with unauthorized access to AT&T’s internal protected computers 
and facilitate the automated process of submitting fraudulent and unauthorized unloek 
requests on behalf of the conspiracy. 

22. The unauthorized computer hardware devices, like the malware, used 
network credentials that belonged to actual AT&T employees, ineluding co-conspirators 
and others, and allowed MUHAMMAD FAHD, and others known and unknown to the 
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Grand Jury, to log into AT&T’s internal protected computers under false pretenses and to 
process fraudulent and unauthorized unlock requests. 

23. During the course of the conspiracy, MUHAMMAD FAHD, GHULAM 
JIWANI, and other co-conspirators who were not associated with AT&T, paid more than 
$1,000,000 in bribes to AT&T insiders who joined the conspiracy. MUHAMMAD 
FAHD, GHULAM JIWANI, and other co-conspirators paid these bribes to induce the 
AT&T insiders to unlock cellular phones without authorization, including by installing 
malware and unauthorized hardware on AT&T’s computer systems. 

24. During the course of the conspiracy, the conspirators caused more than 
2,000,000 cellular telephones fraudulently to be unlocked by AT&T through the AT&T 
insiders’ submission of fraudulent unlocking requests and through the conspirators’ use 
of malware and hardware installed on AT&T’s systems by the AT&T insiders to conduct 
unauthorized unlocks. 

B. Defendant MUHAMMAD FAHD’s Participation in the Conspiracy 

25. It was part of the conspiracy that MUHAMMAD FAHD, doing business as 
Endless Trading FZE (aka Endless Trading FZC), Endless Connections Inc., and 
iDevelopment Co. recruited insiders at AT&T who were willing to take bribes to work on 
behalf of the conspiracy. 

26. MUHAMMAD FAHD contacted the insiders at AT&T via telephone, 
Facebook, and other communication channels in interstate and foreign commerce and 
offered to pay them to unlock cell phones. MUHAMMAD FAHD instructed the insiders 
to obtain pre-paid cellular phones and anonymous online email accounts to communicate 
with him. 

27. MUHAMMAD FAHD also instructed the insiders to create shell 
companies and open business banking accounts in the names of the shell companies to 
receive payments for their work on behalf of the conspiracy. 
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28. MUHAMMAD FAHD obtained lists of IMEI numbers for cellular 
telephones from co-conspirators, and others, who operated businesses that offered 
unlocking services to customers for a fee. 

29. Begiiming in or about August 2012, MUHAMMAD FAHD and GHULAM 
JIWANI sent lists of IMEI numbers for cellular telephones via the wires in interstate and 
foreign commerce to the insiders with instructions to submit unauthorized unlock 
requests for the IMEIs using their access to AT&T’s protected internal computer 
network. 

30. Beginning in or about April 2013, MUHAMMAD FAHD sent malware to 
the insiders via the wires in interstate and foreign commerce and instructed them to install 
the malware on AT&T’s computer network. The malware was designed to gather 
confidential and proprietary information regarding the structure and functioning of 
AT&T’s internal protected computers and applications. 

31. Using information collected by the malware, MUHAMMAD FAHD, and 
others known and unknown to the Grand Jury, created additional malware designed to 
facilitate the transmission of commands via the wires in interstate and foreign commerce 
from a remote server to AT&T’s protected internal computer network and to submit 
unauthorized unlock requests. 


32. MUHAMMAD FAHD sent the insiders multiple versions of the imlocking 
malware to test and perfect the malware on behalf of the conspiracy. Once the malware 
was perfected, MUHAMMAD FAHD instructed the insiders to plant the unlocking 
malware on AT&T’s internal protected computers and to run the unlocking malware 
while they were at work. The imlocking malware used valid AT&T network credentials 
that belonged to co-conspirators and others, without authorization, to interact with 
AT&T’s internal protected computer network and process automated unauthorized 
unlock requests submitted from an external server. 

33. In or about October 2013, AT&T discovered the unlocking malware and 
identified several insiders who were operating the unlocking malware at MUHAMMAD 
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FAHD’s direction. Those insiders subsequently left AT&T after being approached by 
AT&T investigators. 

34. As a result, beginning in or about November 2014, MUHAMMAD FAHD 
recruited new insiders at AT&T willing to accept bribes to work on behalf of the 
conspiracy. 

35. MUHAMMAD FAHD and others known and unknown to the Grand Jury, 
began programming hardware devices designed to facilitate imauthorized access to 
AT&T’s internal protected network for the purpose of processing unauthorized unlock 
requests. 


36. MUHAMMAD FAHD provided the hardware devices to co-conspirators 
including current and former AT&T insiders who tested the devices. Upon perfecting the 
operation of the devices, MUHAMMAD FAHD provided the devices to insiders who 
plugged the devices into AT&T’s internal protected network without authorization to 
facilitate the unlocking of phones in furtherance of the conspiracy. 

37. MUHAMMAD FAHD continued to pay insiders at AT&T to gain 
unauthorized access to AT&T’s internal protected computer network, and exceed their 
authorized access to AT&T’s protected internal computer network to plant malware, 
install unauthorized hardware, and operate malware and unauthorized hardware on 
AT&T’s protected internal computer network on behalf of the conspiracy through in or 
about September 2017. 


C. Defendant GHULAM JIWANI’s Participation in the Conspiracy 

38. It was part of the conspiracy that GHULAM JIWANI received lists of 
thousands of IMEIs from customers of the conspiracy and from co-conspirators that those 
customers wanted to have unlocked. The customers and co-conspirators who provided 
GHULAM JIWANI such lists included customers and co-conspirators that sold cellular 
phone unlocking services to the public. 

39. GHULAM JIWANI caused the lists of IMEIs to be submitted to the AT&T 
insiders so that the AT&T insiders could unlock the cellular phones. GHULAM JIWANI 
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subsequently received reports from the AT&T insiders showing which IMEIs had been 
unlocked, and forwarded these to customers and co-conspirators. GHULAM JIWANI 
also negotiated and obtained payments from customers of the conspiracy. 

40. GHULAM JIWANI made bribe payments to insiders at AT&T. 

GHULAM JIWANI did so by causing payments to be transmitted by Western Union to 
the insiders. GHULAM JIWANI also did so by flying from Pakistan to the United States 
and delivering cash payments to the insiders or to persons who received the cash 
payments on behalf of the insiders. 

41. GHULAM JIWANI facilitated, and attended, a meeting between 
MUHAMMAD FAHD and one of the AT&T insiders. GHULAM JIWANI did so by 
arranging for the insider to travel from the State of Washington to Dubai, United Arab 
Emirates, in order to meet with MUHAMMAD FAHD and to receive payment of a bribe 
from MUHAMMAD FAHD. 

All in violation of Title 18, United States Code, Section 1349. 

COUNT 2 

(Conspiracy to Violate the Travel Act and 
the Computer Fraud and Abuse Act) 

42. The allegations set forth in Coimt 1 of this Second Superseding Indictment 
are re-alleged and incorporated as if fully set forth herein. 

I. THE OFFENSE 

43. Beginning at a date uncertain, but no later than April 2013, and continuing 
through in or about September 2017, at Bothell, within the Western District of 
Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM 
JIWANI, and others known and unknown to the Grand Jury, did knowingly and 
intentionally agree and conspire to: 

a. use a facility in interstate and foreign commerce, namely the wires, 
with the intent to promote, manage, establish, carry on and facilitate the promotion, 
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management, establishment and carrying on of an unlawful activity, that is. Commercial 
Bribery, in violation of the Revised Code of Washington Section 9A.68.060, and 
thereafter performed and attempted to perform an act to distribute the proceeds of such 
unlawful activity, and to promote, manage, establish and carry on, and to facilitate the 
promotion, management, establishment and carrying on of, such unlawful activity in 
violation of Title 18, United States Code, Section 1952(a)(1) and (3); 

b. knowingly and with intent to defraud, access a protected computer 
without authorization and exceed authorized access to a protected computer, and by 
means of such conduct further the intended fraud and obtain anything of value exceeding 
$5,000.00 in any 1-year period, in violation of Title 18, United States Code, Sections 
1030(a)(4) and (c)(3)(A); and 

c. knowingly cause the transmission of a program, information, code, 
and command, and as a result of such conduct, intentionally cause damage without 
authorization to a protected computer, and the offense caused loss to 1 or more persons 
during any 1-year period aggregating at least $5,000 in value and damage affecting 10 or 
more protected computers during a 1-year period, in violation of Title 18, United States 
Code, Sections 1030(a)(5)(A) and (c)(4)(B)(i). 

II. THE OBJECT OF THE CONSPIRACY 

44. The object of the conspiracy is set forth in Paragraph 15 of this Second 
Superseding Indictment and is re-alleged and incorporated as if fully set forth herein. 
Through their conduct, the conspirators caused damages to AT&T’s protected computers, 
including impairment to the integrity and availability of data, programs, systems, and 
information, and caused losses to AT&T for the costs of responding to the offense, 
conducting damage assessments, restoring data, programs, systems and information and 
lost revenue during any 1-year period in excess of $5,000.00. 
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III. THE MANNER AND MEANS OF THE CONSPIRACY 

45. The manner and means of the conspiracy are set forth in Paragraphs 16 
through 41 of this Second Superseding Indictment and are re-alleged and incorporated as 
if fully set forth herein. 

IV. OVERT ACTS 

46. In furtherance of the conspiracy, and to achieve the objects thereof, 
defendants MUHAMMAD FAHD, GHULAM JIWANI and others known and unknown 
to the Grand Jury, did commit and cause to be committed, the following overt acts, at 
Bothell, within the Western District of Washington and elsewhere: 

a. On or about April 11, 2013, MUHAMMAD FAHD opened a Yahoo 
account with the email address unlockoutlet@ymail.com; 

b. In or about April 2013, MUHAMMAD FAHD provided two AT&T 
insiders (CC-2 and CC-3) who were employed at AT&T in Bothell, Washington, with 
malware; 

c. In or about April 2013, each of those AT&T insiders (CC2 and 
CC-3) installed the malware on AT&T’s internal protected network; 

d. On or about April 15, 2013, a co-conspirator wired bribe payments 
in the amount of $11,000.00 to each of the two AT&Ts insiders (CC-2 and CC-3) from 
California to Marysville, Washington; 

e. On or about November 12, 2014, MUHAMMAD FAHD sent a 
WhatApp message to GHULAM JIWANI instructing him to send a $4,000 bribe by 
Western Union to one AT&T insider (CC-2) and a $1,000 bribe by Western Union to 
another AT&T insider (CC-5); 

f. On or about November 25, 2014, MUHAMMAD FAHD sent a 
router to an AT&T insider (CC-2) via Federal Express from Dubai, United Arab 
Emirates, to Lynnwood, Washington; 
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g. In or about November 2014, the AT&T insider (CC-2) provided a 
router configured to provide unauthorized access to AT&T’s internal protected network 
to another AT&T insider (CC-5) to install on AT&T’s network; 

h. On or about August 9, 2015, MUHAMMAD FAHD and GHULAM 
JIWANI traveled to Dubai, United Arab Emirates, from Karachi, Pakistan, to meet an 
AT&T insider (CC-2) and to deliver a bribe payment to him; 

i. On or about February 26, 2015, GHULAM JIWANI traveled to 
Houston, Texas, to deliver a bribe for an AT&T insider (CC-5). 

All in violation of Title 18, United States Code, Section 371. 

COUNTS 3-6 

(Wire Fraud) 

47. The allegations set forth in Counts 1 and 2 of this Second Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

I. THE SCHEME 

48. Beginning at a date uncertain, but no later than April 2012, and continuing 
through in or about September 2017, at Bothell, within the Western District of 
Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM 
JIWANI, and others known and unknown to the Grand Jury, devised and intended to 
devise a scheme to defraud AT&T Mobility LLC, and to obtain money and property by 
means of materially false and fraudulent pretenses, representations and promises. 

II. THE MANNER AND MEANS OF THE SCHEME 

49. The manner and means of the scheme are set forth in Paragraphs 16 
through 41 of this Second Superseding Indictment and are re-alleged and incorporated as 
if fully set forth herein. 
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III. EXECUTION OF THE SCHEME 

50; On or about the dates set forth below, at Bothell, within the Western 
District of Washington, and elsewhere, MUHAMMAD FAHD, GHULAM JIWANI, and 
others known and unknown to the Grand Jury, having devised a scheme and artifice to 
defraud, and to obtain money and property by means of materially false and fraudulent 
pretenses, representations, and promises, did knowingly transmit and cause to be 
transmitted writings, signs, signals, pictures, and sounds, for the purpose of executing 
such scheme, by means of wire communication in interstate and foreign commerce, 
including the following transmissions, with each such transmission constituting a 
separate count of this Second Superseding Indictment. 




3 

April 6, 2013 

MUHAMMAD FAHD 
GHULAM JIWANI 

Email from an AT&T insider 
(CC-3) at Bothell, Washington, 
to MUHAMMAD FAHD, 
outside the State of 

Washington, which then was 
forwarded by MUHAMMAD 
FAHD to GHULAM JIWANI, 
reporting on the status of 
cellular telephone imlocks for a 
list of cellular telephone IMEIs 

4 

April 19, 2013 

MUHAMMAD FAHD 

Email from MUHAMMAD 
FAHD from outside the State of 
Washington, to an AT&T 
insider (CC-2) at Bothell, 
Washington, with attached 
malware and with instructions 
for installing the malware on 

AT&T ’ s computer system 

5 

November 13, 2014 

MUHAMMAD FAHD 
GHULAM JIWANI 

Western Union transfer of 
$4,052 from outside the State of 
Washington to Lynnwood, 
Washington, to pay a bribe to 
an AT&T insider (CC-2) 
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6 

January 8, 2015 

MUHAMMAD FAHD 

E-mail from an AT&T insider 
(CC-5) at Bothell, Washington, 
to MUHAMMAD FAHD, 
outside the State of 

Washington, containing 
photographs of the AT&T 
insider’s work computer screen 


All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT 7 

(Accessing a Protected Computer in Furtherance of Fraud) 

51. The allegations set forth in Counts 1 through 6 of this Second Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

52. Beginning at a date uncertain, but no later than in or about April 2013, and 
continuing until in or around October 2013, at Bothell, within the Western District of 
Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others known 
and unknown to the Grand Jury, knowingly and with intent to defraud accessed protected 
computers without authorization and exceeded authorized access and by means of such 
conduct furthered the intended fraud and obtained something of value, specifically, the 
defendant and others downloaded and installed malware onto AT&T Mobility LLC’s 
protected computers and executed the malware programs designed to facilitate fraudulent 
and unauthorized unlocking transactions on AT&T Mobility LLC’s wireless network and 
by means of such conduct furthered the intended fraud and obtained things of value 
exceeding $5,000.00 in any 1-year period. 

All in violation of Title 18, United States Code, Sections 1030(a)(4) and (c)(3)(A) 

and 2. 
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COUNTS 

(Intentional Damage to a Protected Computer) 

53. The allegations set forth in Counts 1 through 7 of this Second Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

54. Beginning at a date uncertain, but no later than in of about April 2013, and 
continuing until in or around October 2013, at Bothell, within the Western District of 
Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others known 
and unknown to the Grand Jury, knowingly caused the transmission of a program, 
information, code, and command, specifically malicious code that was downloaded and 
installed on AT&T Mobility LLC’s protected computers without AT&T Mobility LLC’s 
knowledge or consent, and as a result of such conduct, intentionally caused damage 
without authorization to protected computers, which damage caused losses to 1 or more 
persons during any 1-year period of at least $5,000.00 and affected 10 or more protected 
computers during a 1 year period. 

All in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and 
(c)(4)(B)(i)and2. 

COUNT9 

(Accessing a Protected Computer in Furtherance of Fraud) 

55. The allegations set forth in Counts 1 through 8 of this Second Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

56. Beginning at a date uncertain, but no later than in or about November 2014, 
and continuing until in or around September 2017, at Bothell, within the Western District 
of Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others 
known and unknown to the Grand Jury, knowingly and with intent to defraud accessed 
protected computers without authorization and exceeded authorized access and by means 
of such conduct furthered the intended fraud and obtained something of value, 
specifically, the defendant and others installed malware and unauthorized hardware onto 
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AT&T Mobility LLC’s protected computers designed to facilitate fraudulent and 
unauthorized unlocking transactions on AT&T Mobility LLC’s wireless network and by 
means of such conduct furthered the intended fraud and obtained things of value 
exceeding $5,000.00 in any 1-year period. 

All in violation of Title 18, United States Code, Sections 1030(a)(4) and (c)(3)(A) 

and 2. 

COUNT 10 

(Intentional Damage to a Protected Computer) 

57. The allegations set forth in Counts 1 through 9 of this Second Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

58. Beginning at a date uncertain, but no later than in or around November 
2014, and continuing until in or around September 2017, at Bothell, within the Western 
District of Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and 
others known and unknown to the Grand Jury, knowingly caused the transmission of a 
program, information, code, and command, through malware and unauthorized hardware 
that was installed on AT&T Mobility LLC’s protected computers without AT&T 
Mobility LLC’s knowledge or consent, and as a result of such conduct, intentionally 
caused damage without authorization to protected computers, which damage caused 
losses to 1 or more persons during any 1-year period of at least $5,000.00 and affected 10 
or more protected computers during a 1 year period. 

All in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and 
(c)(4)(B)(i)and2. 
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COUNTS 11-14 

(Travel Act) 

59. The allegations set forth in Counts 1 through 10 of this Seeond Superseding 
Indictment are re-alleged and incorporated as if fully set forth herein. 

60. On or about the dates below, at Bothell, within the Western District of 
Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM 
JIWANI, and others known and unknown to the Grand Jury, used a facility in interstate 
and foreign commerce with the intent to distribute the proceeds, and to promote, manage, 
establish, carry on and facilitate the promotion, management, establishment and carrying 
on, of an unlawful activity, that is: Commercial Bribery in violation of Revised Code of 
Washington Section 9A.68.060, and thereafter performed and attempted to perform an act 
to distribute the proceeds, and to promote, manage, establish and carry on and facilitate 
the promotion, management, establishment and carrying on, of such unlawful activity. 




11 

April 15,2013 

MUHAMMAD FAHD 

Payment of $ 11,000, by wire 
transfer, from an account 
outside the State of Washington 
to an account at Chase Bank 
within the State of Washington 
to pay a bribe to an AT«feT 
insider (CC-3) 

12 

November 13, 2014 

MUHAMMAD FAHD 
GHULAM JIWANI 

Payment of $4,052 by Western 
Union, from outside the State of 
Washington, to an AT&T 
insider (CC-2) in Lynnwood, 
Washington, to pay a bribe to 
that insider 

13 

November 13, 2014 

MUHAMMAD FAHD 
GHULAM JIWANI 

Payment of $948 by Western 
Union, from outside the State of 
Washington, to an AT&T 
insider (CC-5), in Everett, 
Washington, to pay a bribe to 
that insider 
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Count 

Date(s).^.. 

Defimda^s) Charged 

Act Performed i 

14 

August 10, 2015 

MUHAMMAD FAHD 
GHULAM JIWANI 

Purchase of ticket for flight by 
an AT&T insider (CC-2), and 
subsequent flight by that 
insider, by commercial airline 
from SeaTac, Washington, to 
Dubai, United Arab Emirates, to 
meet MUHAMMAD FAHD 
and GHULAM JIWANI 


All in violation of Title 18, United States Code, Sections 1952(a)(1) and (3), 

and 2. 


FORFEITURE ALLEGATIONS 

61. The allegations contained in Counts 1 through 14 of this Second 
Superseding Indictment are hereby re-alleged and incorporated by reference for the 
purpose of alleging forfeitures pursuant to Title 18, United States Code, Section 
981(a)(1)(C), Title 28, United States Code, Section 2461(c), Title 18, United States Code, 
Section 982(a)(2)(B), and Title 18, United States Code, Section 1030(i). 

62. Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, 
United States Code, Section 2461(c), upon conviction of a conspiracy to violate Title 18, 
United States Code, Section 1349, as set forth in Count 1, of a violation of Title 18 
United States Code, Section 1343, as set forth in Counts 3 through 6, the defendants shall 
forfeit to the United States of America, any property, real or personal, which constitutes 
or is derived from proceeds traceable to the charged offense. The property to be forfeited 
includes, but is not limited to, a sum of money representing the amount of proceeds the 
defendant obtained as a result of the charged offense. 

63. Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, 
United States Code, Section 2461(c), upon conviction of a conspiracy to violate Title 18, 
United States Code, Sections 1030(a)(4) and (c)(3)(A) and Title 18, United States Code, 
Sections 1030(a)(5)(A) and (c)(4)(B)(i), in violation of Title 18, United States Code, 
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Section 371, as set forth in Count 2, the defendants shall forfeit to the United States of 
America any property, real or personal, which constitutes or is derived from proceeds 
traceable to the charged offense, and any personal property that was used or intended to 
be used to commit or to facilitate the commission of such offense. The property to be 
forfeited includes, but is not limited to, the following: a sum of money representing the 
amount of proceeds the defendant obtained as a result of the charged offense. 

64. Pursuant to Title 18, United States Code, Section 982(a)(2)(B), and Title 
18, United States Code, Section 1030(i) , upon conviction of a violation of Title 18, 
United States Code, Sections 1030(a)(4) and (c)(3)(A), as set forth in Counts 7 and 9, the 
defendant shall forfeit to the United States of America any property, real or personal, 
which constitutes or is derived from proceeds traceable to the charged offense, and any 
personal property that was used or intended to be used to commit or to facilitate the 
commission of such offense. The property to be forfeited includes, but is not limited to, 
the following: a sum of money representing the amount of proceeds the defendant 
obtained as a result of the charged offense. 

65. Pursuant to Title 18, United States Code, Section 982(a)(2)(B), and Title 
18, United States Code, Section 1030(i) , upon conviction of a violation of Title 18, 
United States Code, Sections 1030(a)(5)(A) and (c)(4)(B)(i), as set forth in Counts 8 and 
10, the defendant shall forfeit to the United States of America any property, real or 
personal, which constitutes or is derived from proceeds traceable to the charged offense. 
The property to be forfeited includes, but is not limited to, the following: a sum of money 
representing the amount of proceeds the defendant obtained as a result of the charged 
offense. 


66. Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, 
United States Code, Section 2461(c), upon conviction of a Travel Act violation, in 
violation of Title 18, United States Code, Section 1952(a)(1) and (3), as set forth in 
Counts 11 through 14, the defendants shall forfeit to the United States of America any 
property, real or personal, which constitutes or is derived from proceeds traceable to the 
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charged offense. The property to be forfeited includes, but is not limited to, the 
following: a sum of money representing the amount of proceeds the defendant obtained 
as a result of the charged offense. 

67. If any of the property described above, as a result of any act or omission 
of the defendants: 

a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with, a third party; 

c. has been placed beyond the jurisdiction of the court; 

d. has been substantially diminished in value; or 

e. has been commingled with other property which cannot be divided 
without difficulty, the United States of America shall be entitled to 

// 

// 

// 

// 

// 
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